From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.bugs Subject: bug#7952: 24.0.50; crash in find_interval Date: Sat, 19 Mar 2011 12:37:51 +0200 Message-ID: <83r5a3qtts.fsf@gnu.org> References: <87r5ag7a72.fsf@silenus.orebokech.com> <87lj0c1bj8.fsf@silenus.orebokech.com> <8339mkrzic.fsf@gnu.org> <87ei6417kl.fsf@silenus.orebokech.com> Reply-To: Eli Zaretskii NNTP-Posting-Host: lo.gmane.org X-Trace: dough.gmane.org 1300532877 28164 80.91.229.12 (19 Mar 2011 11:07:57 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Sat, 19 Mar 2011 11:07:57 +0000 (UTC) Cc: 7952@debbugs.gnu.org To: Romain Francoise Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Sat Mar 19 12:07:53 2011 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([199.232.76.165]) by lo.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1Q0u0e-0005JR-QI for geb-bug-gnu-emacs@m.gmane.org; Sat, 19 Mar 2011 12:07:53 +0100 Original-Received: from localhost ([127.0.0.1]:39827 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Q0u0d-0007EG-Md for geb-bug-gnu-emacs@m.gmane.org; Sat, 19 Mar 2011 07:07:51 -0400 Original-Received: from [140.186.70.92] (port=56190 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Q0tzu-0006i1-DI for bug-gnu-emacs@gnu.org; Sat, 19 Mar 2011 07:07:09 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Q0tzq-0002qO-9Q for bug-gnu-emacs@gnu.org; Sat, 19 Mar 2011 07:07:05 -0400 Original-Received: from debbugs.gnu.org ([140.186.70.43]:59704) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Q0tzq-0002qD-7x for bug-gnu-emacs@gnu.org; Sat, 19 Mar 2011 07:07:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.69) (envelope-from ) id 1Q0tYk-0002Uf-SI; Sat, 19 Mar 2011 06:39:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Eli Zaretskii Original-Sender: debbugs-submit-bounces@debbugs.gnu.org Resent-To: owner@debbugs.gnu.org Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Sat, 19 Mar 2011 10:39:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 7952 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: Original-Received: via spool by 7952-submit@debbugs.gnu.org id=B7952.13005311019535 (code B ref 7952); Sat, 19 Mar 2011 10:39:02 +0000 Original-Received: (at 7952) by debbugs.gnu.org; 19 Mar 2011 10:38:21 +0000 Original-Received: from localhost ([127.0.0.1] helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1Q0tY3-0002Th-7K for submit@debbugs.gnu.org; Sat, 19 Mar 2011 06:38:20 -0400 Original-Received: from mtaout23.012.net.il ([80.179.55.175]) by debbugs.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1Q0tY0-0002TS-1g for 7952@debbugs.gnu.org; Sat, 19 Mar 2011 06:38:17 -0400 Original-Received: from conversion-daemon.a-mtaout23.012.net.il by a-mtaout23.012.net.il (HyperSendmail v2007.08) id <0LIA00600VUBD300@a-mtaout23.012.net.il> for 7952@debbugs.gnu.org; Sat, 19 Mar 2011 12:37:53 +0200 (IST) Original-Received: from HOME-C4E4A596F7 ([77.124.131.120]) by a-mtaout23.012.net.il (HyperSendmail v2007.08) with ESMTPA id <0LIA006MVW7007C0@a-mtaout23.012.net.il>; Sat, 19 Mar 2011 12:37:53 +0200 (IST) In-reply-to: <87ei6417kl.fsf@silenus.orebokech.com> X-012-Sender: halo1@inter.net.il X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.11 Precedence: list Resent-Date: Sat, 19 Mar 2011 06:39:02 -0400 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 3) X-Received-From: 140.186.70.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:45164 Archived-At: > From: Romain Francoise > Cc: 7952@debbugs.gnu.org > Date: Fri, 18 Mar 2011 21:45:30 +0100 > > Also, this is not specific to my machine because I can > reproduce it on fencepost. I generated a core file for you > (~rfrancoise/emacs/core) if you want to have a closer look. Now, that's one weird crash. Observe: (gdb) bt 10 #0 0x00007fd2af56dd57 in kill () from /lib/libc.so.6 #1 0x000000000053bb1d in fatal_error_signal (sig=6) at emacs.c:342 #2 #3 0x00007fd2af56dd57 in kill () from /lib/libc.so.6 #4 0x000000000053bb3c in abort () at emacs.c:371 #5 0x0000000000648688 in find_interval (tree=0x0, position=255426) at intervals.c:635 #6 0x000000000064af6f in set_point_both (charpos=255426, bytepos=255426) at intervals.c:2007 #7 0x000000000048a9b2 in window_scroll_line_based (window=18497157, n=-49, whole=1, noerror=0) at window.c:5123 #8 0x00000000004896cf in window_scroll (window=18497157, n=-1, whole=1, noerror=0) at window.c:4713 #9 0x000000000048ad6d in scroll_command (n=12466818, direction=-1) at window.c:5246 (More stack frames follow...) (gdb) frame 6 #6 0x000000000064af6f in set_point_both (charpos=255426, bytepos=255426) at intervals.c:2007 (gdb) l 2007 to = find_interval (BUF_INTERVALS (current_buffer), charpos); 2008 if (charpos == BEGV) 2009 toprev = 0; 2010 else if (to && to->position == charpos) 2011 toprev = previous_interval (to); 2012 else 2013 toprev = to; 2014 2015 buffer_point = (PT == ZV ? ZV - 1 : PT); 2016 (gdb) p current_buffer->text->intervals $24 = (INTERVAL) 0x314b4c0 (gdb) down #5 0x0000000000648688 in find_interval (tree=0x0, position=255426) at intervals.c:635 (gdb) info address tree Symbol "tree" is a variable in $rax. (gdb) current_buffer->text->intervals is the expansion of "BUF_INTERVALS (current_buffer)" (btw, please use -g3 when you compile an unoptimized version, because then the macro information is present in the debug info in a form that GDB can use, rather than me having to look up the macro in the sources and manually expand it). So BUF_INTERVALS (current_buffer) is 0x314b4c0 in set_point_both, but when find_interval is called with that value as the first argument, the value winds up as zero inside find_interval! The code in find_interval leading to the abort is this: INTERVAL find_interval (register INTERVAL tree, register EMACS_INT position) { /* The distance from the left edge of the subtree at TREE to POSITION. */ register EMACS_INT relative_position; if (NULL_INTERVAL_P (tree)) return NULL_INTERVAL; relative_position = position; if (INTERVAL_HAS_OBJECT (tree)) { Lisp_Object parent; GET_INTERVAL_OBJECT (parent, tree); if (BUFFERP (parent)) relative_position -= BUF_BEG (XBUFFER (parent)); } if (relative_position > TOTAL_LENGTH (tree)) abort (); /* Paranoia */ There's nothing in this code that modifies `tree' in any way. (I even disassembled the code to make sure.) So how come a non-NULL value becomes NULL here? Since this value is passed in a register by the caller and kept in a register from the very beginning of the function, not even some missing GCPRO somewhere could explain this. What am I missing? Ideas are welcome.